The Philippines did not set out to build a digital surveillance architecture. It built one by accumulation—each statute arriving with a defensible rationale, each gap between them quietly exploited. The SIM Registration Act (Republic Act No. 11934, 2022) was framed as an anti-fraud measure. The Cybercrime Prevention Act (Republic Act No. 10175, 2012) was framed as consumer protection. The National Privacy Commission (NPC) was created to protect citizens from both. Together, the three have created a system in which every online voice is identifiable, criminal speech liability attaches to digital expression, and the regulator meant to prevent abuse operates largely in an advisory capacity. By December 2025, online libel had become the single most recorded cybercrime category in the Philippines—an outcome critics of this architecture had predicted.
The SIM Registry: 113 Million Identities on File
RA 11934, signed by President Ferdinand Marcos Jr. on October 10, 2022 and effective December 27 of that year, requires all mobile SIM cards to be registered with the subscriber's verified government-issued identity before activation. By July 2023, more than 113 million SIM cards had been registered under the mandate.
The stated purpose was legitimate and urgent. Text-based phishing and scam operations had become a serious consumer-harm issue, and real-name linkage to phone numbers offered law enforcement a direct identification tool. The strongest case for the law is precisely this: in high-volume fraud environments, anonymous telecommunications enable mass criminal operations, and attribution capacity is a precondition for prosecution.
But the data architecture RA 11934 created is significant beyond fraud. Telecommunications providers must retain subscriber records for ten years from SIM deactivation. Law enforcement may obtain subscriber identity data upon a court-issued subpoena, or under an "immediate necessity" standard defined in the law's Implementing Rules and Regulations. There is no separate, heightened standard for accessing SIM data in speech-related investigations versus fraud investigations. The same court-order mechanism that unlocks a scammer's identity unlocks a critic's.
Cyberlibel: Criminal, Not Civil
Section 4(c)(4) of RA 10175 extends traditional Philippine libel to digital communications, imposing a penalty one degree higher than conventional libel—up to imprisonment of prision mayor and fines between PhP 200,000 and PhP 1,000,000. The Supreme Court upheld the provision in Disini v. Secretary of Justice (2014), though it invalidated the law's overbroad aiding-and-abetting clause.
The chilling effect of criminal cyberlibel is not hypothetical. It is documented in the conviction of journalist Maria Ressa and researcher Reynaldo Santos Jr. under RA 10175—a case widely criticised by international press-freedom groups. The Philippines received a "Partly Free" score of 60/100 from Freedom House in 2024, with the report noting that "internet freedom declined" as cyberattacks against news outlets persisted and self-censorship among journalists increased.
Senate Bill No. 250, introduced in the 19th Congress in 2025, proposes replacing criminal penalties with civil liability for libel. Its sponsors argue—correctly—that civil defamation remedies protect reputations without the coercive mechanism of potential imprisonment that, in practice, silences speech regardless of whether prosecution succeeds. Criminal process is itself the punishment.
The NPC: Present at the Warning, Absent from the Remedy
The National Privacy Commission was established under the Data Privacy Act of 2012 (RA 10173) to regulate personal data processing and enforce data protection rights. Before RA 11934 passed, the NPC issued a public statement acknowledging that implementation would entail a "massive collection of personal data" and explicitly advised against using a centralised database for SIM records, citing heightened breach risk.
Those concerns were heard but not operationalised into legislative constraints. The NPC has since issued NPC Circular No. 2025-01 (governing body-worn cameras) and NPC Advisory Opinion No. 2026-001 (on data scraping practices)—neither of which addresses the gap between SIM registry access and cyberlibel investigations. There is no formal protocol limiting the use of RA 11934 subscriber data in RA 10175 prosecutions. The NPC retains the authority to investigate and sanction misuse after the fact, but no pre-authorisation or heightened threshold governs law enforcement's speech-related subscriber queries.
The Evidence: A Law That Failed Its Stated Mission
The empirical record on RA 11934's anti-fraud effectiveness is damaging. Despite mandatory registration, SIM card-related cybercrimes surged 190 percent in the first half of 2023 compared to the prior year, according to the PNP Anti-Cybercrime Group. The National Bureau of Investigation demonstrated a structural flaw: a SIM card was successfully registered using a fake health card bearing an image of a monkey, confirming that biometric verification had not been implemented. Black markets for pre-registered SIMs emerged within months.
By December 2025, the Department of Information and Communications Technology reported that total cybercrime incidents had fallen 38 percent to 8,987 cases—yet online libel had become the leading category. A tool introduced to curb fraud had become most operationally associated with speech prosecutions. The architecture had found its most productive use in exactly the direction critics had warned about.
What Proportionate Reform Looks Like
The Philippines' reform options are interconnected. Decriminalising cyberlibel—as Senate Bill No. 250 proposes—would remove the most coercive element of the speech-prosecution corridor. Civil liability for defamation is a proportionate remedy; criminal imprisonment is not.
Separately, the NPC should be empowered to establish distinct access standards for SIM registry data in speech-related versus fraud-related investigations—a heightened judicial threshold, or at minimum a formal notification requirement when RA 11934 data is sought in RA 10175 prosecutions. The National Union of Journalists of the Philippines has called for full repeal of RA 11934; that may overreach, but targeted reform of the law's law-enforcement access provisions is clearly warranted.
The Philippines has genuine cybercrime problems that require genuine tools. But a surveillance-ready speech architecture built from interlocking statutes—where anonymity has been stripped, expression is criminalised, and the privacy regulator cannot police the intersection—is not a proportionate response to fraud. It is a structure that will find the uses critics predicted, because the uses were always structurally available.